CVE-2023-39475: critical vulnerability in Inductive Automation Ignition
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 64%
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ParameterVersionJavaSerializationCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20290.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Inductive Automation · IgnitionRelated CVEs — Inductive Automation Ignition
In the same product, most dangerous first.
CVE-2023-39473HIGHInductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 62.5%CVE-2022-35869HIGHCVE-2022-35869EPSS 59.9%CVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2023-50218HIGHInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.0%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 54.9%CVE-2022-35870HIGHCVE-2022-35870EPSS 44.3%